All MIBs › ZHNFIREWALL
Organization: Zhone Technologies, Inc.
Last Updated: 2012-04-18
Category: Network Security and Firewalls
Description:
Manages Zhone Technologies CPE firewall rules, NAT configuration, and packet filtering policy settings.
Imported Objects
From SNMPv2-CONF
| MODULE-COMPLIANCE | |
| OBJECT-GROUP |
From SNMPv2-SMI
| Gauge32 | |
| Integer32 | |
| IpAddress | |
| MODULE-IDENTITY | |
| OBJECT-TYPE | |
| Unsigned32 | |
| enterprises |
From SNMPv2-TC
| MacAddress | |
| RowStatus | |
| TEXTUAL-CONVENTION | |
| TruthValue |
From Zhone
| zhoneWtn | OBJECT-IDENTITY |
From Zhone-TC
| ZhoneRowStatus |
What Is ZHNFIREWALL?
ZHNFIREWALL is a Zhone Technologies enterprise MIB that defines LAN management-access filtering and port-forwarding objects for Zhone customer-premises equipment (CPE), mapping directly onto the TR-069 X_ZHONE_MgmtAccessCfg and X_ZHONE_PortForwardingCfg data models. The firewallMgmtAccessTable lets an operator block or allow specific management protocols -- HTTP, HTTPS, ping, SNMP, SNMP trap, SSH, and Telnet -- per LAN interface via firewallMgmtAction, hardening the device's own management plane against external attacks. The firewallPortForwardingTable configures NAT/port-forwarding rules, each specifying a firewallPortType (port range, port remap, or DMZ), a firewallPortProtocol (TCP/UDP/ICMP), a public port range, a private port, and the private IP address traffic is forwarded to, with lifecycle managed through a Zhone-specific RowStatus. As a configuration MIB, monitoring it is mainly about auditing which management services are exposed and which forwarding/DMZ rules are active, since these rules only take effect once the CPE's global firewall object is enabled. It depends on the ZHNLANDEVICE MIB for its lanDeviceIndex/lanEthernetIndex table indexes and the Zhone/Zhone-TC enterprise trees for common types, and it is deployed on Zhone CPE gateways, and administrators can download the ZHNFIREWALL MIB to audit or automate these firewall rules.
IPNetwork Monitor allows you to monitor SNMP objects defined in ZHNFIREWALL. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.
What Can Be Monitored
- management-access service block/allow state (HTTP, SSH, Telnet, etc.)
- port-forwarding rule type (range/remap/DMZ)
- forwarded protocol and port ranges
- private IP address of forwarding targets
- port-forwarding rule row status
Supported Devices
- Zhone Technologies CPE gateways
Monitoring Examples
An operator walks firewallMgmtAccessTable to confirm telnet and http management access are set to deny(2) rather than allow(1), and reviews firewallPortForwardingTable for any DMZ(3) rule; a DMZ rule with a stale firewallPortPrivateIPAddress pointing at a decommissioned host would indicate a forgotten forwarding rule exposing an internal device to all inbound ports.
OIDs
| OID symbolic | OID numeric | Type | Access | Description |
|---|---|---|---|---|
| zhnFirewall | 1.3.6.1.4.1.5504.2.5.45 | This file defines the private Enterprise MIB extensions that define LAN Management Access Service Filters and Port Forwarding objects supported by the Zhone CPEs. | ||
| zhnFirewallObjects | 1.3.6.1.4.1.5504.2.5.45.1 | |||
| firewallMgmtAccessTable | 1.3.6.1.4.1.5504.2.5.45.1.1 | not-accessible | Table of LAN Management Access Service Filters | |
| firewallMgmtAccessEntry | 1.3.6.1.4.1.5504.2.5.45.1.1.1 | not-accessible | Table of entries of LAN Management Access service filters. This table is used to configure management access on the device. It is useful in making the device management network by blocking protocols or services that are highly susceptible to external attacks. | |
| FIR firewallMgmtServiceIndex | 1.3.6.1.4.1.5504.2.5.45.1.1.1.1 | FirewallMgmtAccessServiceValues | not-accessible | LAN Management Access Services Table index. Enumerated values: Http (1), Https (2), Ping (3), Snmp (4), SnmpTrap (5), Ssh (6), Telnet (7) |
| OCT firewallMgmtService | 1.3.6.1.4.1.5504.2.5.45.1.1.1.2 | OCTET STRING | read-only | LAN Management Access Service description. |
| FIR firewallMgmtAction | 1.3.6.1.4.1.5504.2.5.45.1.1.1.3 | FirewallMgmtAccessServiceActions | read-write | LAN Management Access Service filtering action. Enumerated values: Allow (1), Deny (2), Undefined (3) |
| firewallPortForwardingTable | 1.3.6.1.4.1.5504.2.5.45.1.2 | not-accessible | Table of LAN Port Forwarding Rules. Note that the rules in this table have no effect until the global firewall object (sysFirewallEnable) is enabled. | |
| firewallPortForwardingEntry | 1.3.6.1.4.1.5504.2.5.45.1.2.1 | not-accessible | This table is used to configure port forwarding firewall rules for the device. | |
| U32 firewallPortForwardingIndex | 1.3.6.1.4.1.5504.2.5.45.1.2.1.1 | Unsigned32 | not-accessible | LAN Port Forwarding Rules index. |
| OCT firewallPortForwardingName | 1.3.6.1.4.1.5504.2.5.45.1.2.1.2 | OCTET STRING | read-write | Descriptive name for a LAN Port Forwarding Rule. |
| FIR firewallPortType | 1.3.6.1.4.1.5504.2.5.45.1.2.1.3 | FirewallPortTypeValues | read-write | Enumerated value of: portRange (1), -- Range indicates that any traffic on those ports will be -- sent to the private IP address. portRemap (2), -- Remap indicates that any traffic on those ports will be -- sent to the private IP address at the private port. dmz (3) -- When DMZ is chosen it is the only rule allowed on that -- interface. A DMZ rule is effectively the same as a Range -- rule with all ports included. Range rules are more secure -- than setting a DMZ rule, because Range rules allow specific -- ports or groups of ports to be opened up. |
| FIR firewallPortProtocol | 1.3.6.1.4.1.5504.2.5.45.1.2.1.4 | FirewallPortProtocolValues | read-write | Enumerated value of: tcp (1), udp (2), tcpOrUdp (3), icmp (4), icmpv4 (5), none (6) |
| U32 firewallPortPublicPortStart | 1.3.6.1.4.1.5504.2.5.45.1.2.1.5 | Unsigned32 | read-write | Lowest value port number for the range. |
| U32 firewallPortPublicPortEnd | 1.3.6.1.4.1.5504.2.5.45.1.2.1.6 | Unsigned32 | read-write | Highest value port number for the range. This can be equal to firewallPortPublicPortStart if there is only one port. |
| U32 firewallPortPrivatePort | 1.3.6.1.4.1.5504.2.5.45.1.2.1.7 | Unsigned32 | read-write | The port number with which to send the traffic. |
| IP firewallPortPrivateIPAddress | 1.3.6.1.4.1.5504.2.5.45.1.2.1.8 | IpAddress | read-write | The port IP Address with which to send the traffic. |
| ZHO firewallPortForwardingRowStatus | 1.3.6.1.4.1.5504.2.5.45.1.2.1.9 | ZhoneRowStatus | read-write | The SNMP RowStatus of the current row. The following objects must be specified upon row creation: firewallPortForwardingName firewallPortPrivateIPAddress |
| zhnFirewallConformance | 1.3.6.1.4.1.5504.2.5.45.3 | |||
| zhnFirewallGroups | 1.3.6.1.4.1.5504.2.5.45.3.1 | |||
| zhnFirewallMgmtAccessGroup | 1.3.6.1.4.1.5504.2.5.45.3.1.1 | A collection of Zhone IP objects that describe the LAN Management Access Services that can be filtered for a particular LAN interface. | ||
| zhnFirewallPortForwardingGroup | 1.3.6.1.4.1.5504.2.5.45.3.1.2 | A collection of Zhone IP objects that describe the LAN Port Forwarding Management rules for filtering protocols and ports for a particular LAN interface. | ||
| zhnFirewallCompliances | 1.3.6.1.4.1.5504.2.5.45.3.2 | |||
| zhnFirewallCompliance | 1.3.6.1.4.1.5504.2.5.45.3.2.1 | The Compliance statement for SNMP entities which manage the Zhone CPE LAN Firewall Management Access Services and Port Forwarding Information |
RFC description
Zhonghua Network firewall management MIB; manages firewall rules, connections, and security policies for ZHN security appliances.
Start monitoring Zhone Technologies CPE gateways (management-access-filter/port-forwarding config status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.